Security context constraints

The Red Hat OpenShift Container Platform (OCP) provides pod security policies using SecurityContextConstraints (SCC) resources rather than the PodSecurityPolicies (PSP) like all other Kubernetes platforms. SCCs control the actions that a pod can perform and what it has the ability to access. IBM Cloud Private on OCP installations uses SCCs instead of PSPs.

By default, stand-alone OCP uses the SecurityContextConstraints name restrictedSCC. However, the predefined SecurityContextConstraints name for this chart is ibm-restricted-scc. If your target namespace is bound to this SecurityContextConstraints resource, you can proceed to install the chart.

This chart also defines a custom SecurityContextConstraints resource which can be used to finely control the permissions and capabilities needed to deploy this chart. You can enable this custom resource using the instructions and scripts supplied in the pak_extension pre-install directory.

From the user interface, you can copy and paste the following snippets to enable the custom SecurityContextConstraints:

Custom SecurityContextConstraints definition:

apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  annotations:
    kubernetes.io/description: "This policy is the most restrictive, 
      requiring pods to run with a non-root UID, and preventing pods from accessing the host." 
    cloudpak.ibm.com/version: "1.0.0"
  name: ibm-netcool-probe-scc
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegedContainer: false
allowPrivilegeEscalation: false
allowedCapabilities: []
allowedFlexVolumes: []
allowedUnsafeSysctls: []
defaultAddCapabilities: []
defaultPrivilegeEscalation: false
forbiddenSysctls:
  - "*"
fsGroup:
  type: MustRunAs
  ranges:
  - max: 65535
    min: 1
readOnlyRootFilesystem: false
requiredDropCapabilities:
- ALL
runAsUser:
  type: MustRunAsNonRoot
seccompProfiles:
- docker/default
seLinuxContext:
  type: RunAsAny
supplementalGroups:
  type: MustRunAs
  ranges:
  - max: 65535
    min: 1
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret

From the command line, you can run the setup scripts included under pak_extensions.
As a cluster administrator, the pre-install scripts and instructions are in the following location:

pre-install/clusterAdministration/createSecurityClusterPrereqs.sh

As team admin/operator the namespace scoped scripts and instructions are in the following location:

pre-install/namespaceAdministration/createSecurityNamespacePrereqs.sh

Creating prerequisite resources for SecurityContextConstraints using the command line

Login using cloudctl followed by oc. In the example below, MasterNode_IP refers to the IP address of the master node and ICP_port refers to the ICP port.
```
cloudctl login -a https://<MasterNode_IP>:<ICP_port>
oc login
```
Extract the pre-installation scripts from the archive under the ibm_cloud_pak/pak_extension directory. Example below shows how to extract the scripts from ibm-noi-probe-3.10.4.1-x86.tgz archive.
```
tar xvf ibm-noi-probe-3.10.4.1-x86.tgz ibm_cloud_pak
```
As a cluster administrator, run the createSecurityClusterPrereqs.sh script and provide the target namespace as an argument. This script creates the SecurityContextConstraints and ClusterRole resources. The example command below runs the script on a namespace called my-probe-namespace.
```
cd ibm_cloud_pak/pak_extensions
./pre-install/clusterAdministration/createSecurityClusterPrereqs.sh my-probe-namespace
```
As an administrator or cluster administrator, run the namespace scoped createSecurityNamespacePrereqs.sh script and provide the target namespace as an argument. This script creates the RoleBinding resource for service accounts in the target namespace. The namespace must be created prior to running this script. The example command below runs the script on a namespace called my-probe-namespace.
```
cd ibm_cloud_pak/pak_extensions
./pre-install/namespaceAdministration/createSecurityNamespacePrereqs.sh my-probe-namespace 
```
Verify that the custom SCC has been created.
```
oc get scc | grep <SCC name>
```
You can now proceed to install the chart in the namespace with the custom SecurityContextConstraints.